Last seven days
- First activity
- Jul 26, 2026
- Last activity
- Jul 26, 2026
- Feed role
- Distribution
- Host form
- 1 IP / 1 hostnames
Observed infrastructure
Leading locations
- DE1
Leading providers
- AEZA GROUP LLC1
Infrastructure traits
- Hosting 1
MITRE ATT&CK
Forg365 in ATT&CK
12 distinct techniquesTechniques
12 techniques T1114.003 Email Forwarding Rule T1557 Adversary-in-the-Middle T1114 Email Collection T1566.002 Spearphishing Link T1497 Virtualization/Sandbox Evasion T1078 Valid Accounts T1539 Steal Web Session Cookie T1566 Phishing T1564 Hide Artifacts T1649 Steal or Forge Authentication Certificates T1036 Masquerading T1185 Browser Session Hijacking
Reporting
Research mentioning Forg365
Jul 13
The Hacker News
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
A new phishing-as-a-service (PhaaS) operation called Forg365 is using a combination of device code phishing, adversary-in-the-middle (AitM) tactics, antibot evasion, artificial intelligence (AI)-assisted lure creation, and post-compromise mailbox operations targeting Microsoft 365 accounts.
Jul 9
Bleeping Computer
New Forg365 phishing platform uses AI to target Microsoft 365 accounts
A new phishing-as-a-service (PhaaS) operation called Forg365 focuses on stealing Microsoft 365 accounts by combining adversary-in-the-middle (AiTM) and device code methods with AI-assisted lure generation.
